|
🇩🇪
Blexyel
|
|
34.83.51.204 - - [17/Sep/2026:13:53:50 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 577 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
...
|
Brute-Force
Web App Attack
|
|
🇩🇪
ghostwarriors
|
|
Attempts against non-existent wp-login
|
Brute-Force
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 34.83.51.204 (204.51.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 07:44:44.945042 2026] [security2:error] [pid 9440:tid 944 ...
show more
(mod_security) mod_security (id:225170) triggered by 34.83.51.204 (204.51.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 07:44:44.945042 2026] [security2:error] [pid 9440:tid 9440] [client 34.83.51.204:50287] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.fltsiminc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fltsiminc.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqvSrEBxnjqpA4-Prd7paQAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇬🇧
Comberton
|
|
Ban via by F2B apache-wordfence jail
|
Brute-Force
|
|
🇩🇪
ger-stg-sifi1
|
|
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
|
Web App Attack
|
|
🇩🇪
yitzhaq
|
|
34.83.51.204 - - [17/Sep/2026:13:33:03 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.83.51.204 - - [17/Sep/2026 ...
show more
34.83.51.204 - - [17/Sep/2026:13:33:03 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.83.51.204 - - [17/Sep/2026:13:33:04 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.83.51.204 - - [17/Sep/2026:13:33:04 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.83.51.204 - - [17/Sep/2026:13:33:04 +0200] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
34.83.51.204 - - [17/Sep/2026:13:33:04 +0200] "GET //website/wp-includes/wlwmanifest.xml HTTP/1.1
show less
|
Web App Attack
Hacking
|
|
🇮🇹
🐷🐷🐷
|
|
Multiple WordPress unauthorized access attempts
...
|
Brute-Force
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 34.83.51.204 (204.51.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 07:23:04.883517 2026] [security2:error] [pid 20247:tid 20 ...
show more
(mod_security) mod_security (id:225170) triggered by 34.83.51.204 (204.51.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 07:23:04.883517 2026] [security2:error] [pid 20247:tid 20247] [client 34.83.51.204:49565] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||finewebdining.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "finewebdining.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqvNmOxbpp6hhEbtsvmNJwAAAA8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇫🇷
fineservice
|
|
PrestaShop Security Module: WordPress probe path detected
|
Web App Attack
|
|
🇯🇵
beon
|
|
[DateTime=>2026-09-17T11:22:48Z to 2026-09-17T11:22:49Z (UTC)] , [HoneyPot_Hits=>4 times] , [HoneyPots=>/wp-includes/wlwmanifest.xml, /wp-json/wp/v2/users/, /wp-json/oembed/1.0/embed, /xmlrpc.php] , [total_Hits=>4 times] , [hit_per_second=>4] , [Keyw ...
show more
[DateTime=>2026-09-17T11:22:48Z to 2026-09-17T11:22:49Z (UTC)] , [HoneyPot_Hits=>4 times] , [HoneyPots=>/wp-includes/wlwmanifest.xml, /wp-json/wp/v2/users/, /wp-json/oembed/1.0/embed, /xmlrpc.php] , [total_Hits=>4 times] , [hit_per_second=>4] , [Keyword=>WordPress]
show less
|
Bad Web Bot
Web App Attack
|
|
🇫🇷
largo-it.net
|
|
[17/Sep/2026:13:20:17.188] HTTP 404 - GET /fr//wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:17.428] HTTP 404 - GET /fr//xmlrpc.php?rsd
[17/Sep/2026:13:20:18.628] HTTP 404 - GET /fr//blog/wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:19.986] HTTP 4 ...
show more
[17/Sep/2026:13:20:17.188] HTTP 404 - GET /fr//wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:17.428] HTTP 404 - GET /fr//xmlrpc.php?rsd
[17/Sep/2026:13:20:18.628] HTTP 404 - GET /fr//blog/wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:19.986] HTTP 404 - GET /fr//web/wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:20.394] HTTP 404 - GET /fr//wordpress/wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:20.661] HTTP 404 - GET /fr//website/wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:21.167] HTTP 404 - GET /fr//wp/wp-includes/wlwmanifest.xml
[17/Sep/2026:13:20:21.631] HTTP 404 - GET /fr//news/wp-includes/wlwmanifest.xml
show less
|
Hacking
Bad Web Bot
Web App Attack
|
|
🇺🇸
nyt
|
|
Empty UA + error, WP Author Enumeration, WP User Enumeration
|
Web App Attack
|
|
🇳🇴
Bots.go.to.hell
|
|
This IP was detected by CrowdSec triggering custom/ip-honeypot
|
Web App Attack
Bad Web Bot
|
|
Anonymous
|
|
[redacted] 34.83.51.204 - - [17/Sep/2026:13:18:14 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.83.51.204 - - [17/S ...
show more
[redacted] 34.83.51.204 - - [17/Sep/2026:13:18:14 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.83.51.204 - - [17/Sep/2026:13:18:14 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.83.51.204 - - [17/Sep/2026:13:18:14 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.83.51.204 - - [17/Sep/2026:13:18:14 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
[redacted] 34.83.51.204 - - [17/Sep/2026:13:18:14 +0200] "POST //xmlrpc.php HTTP/1.1" 2
...
show less
|
Hacking
Web App Attack
|
|
🇩🇪
big-cloud.nl
|
|
Try to access /xmlrpc.php?rsd
|
Web App Attack
|